Notifications
Clear all
Topic starter
17/08/2026 4:39 pm
TL;DR: Infrastructure identity should unify human and machine access because static credentials, fragmented tools, and point solutions cannot keep pace with modern infrastructure complexity, according to Teleport's analysis. The real issue is that access governance still assumes identity is stable, human-centred, and reviewable on a normal cadence, which no longer matches how infrastructure now operates.
NHIMG editorial — based on content published by Teleport: The Missing Link Between Infrastructure Resiliency and High-Velocity Engineering
By the numbers:
- More than 70% of breaches begin with stolen or misused credentials, including compromised logins, hardcoded API keys, and other static secrets.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
- NHIs outnumber human identities by 25x to 50x in modern enterprises.
Questions worth separating out
Q: How should security teams reduce reliance on static credentials for workloads?
A: Start by identifying which workloads can authenticate with cloud identity, Kubernetes identity, OIDC, certificates, or attestation instead of carrying reusable secrets.
Q: Why do machine identities complicate identity governance more than human accounts?
A: Machine identities act continuously, at scale, and with delegated authority, so they cannot rely on manual review cycles or human pauses.
Q: What breaks when identity governance is spread across too many vendor tools?
A: Lifecycle operations become inconsistent, audit trails become incomplete and deprovisioning becomes slower.
Practitioner guidance
- Inventory every static credential path Map where passwords, secrets, SSH keys, and API tokens are stored across code, CI/CD tools, vaults, and runtime environments.
- Consolidate governance across identity classes Create one operating model for humans, workloads, service accounts, and elevated access so that reviews, ownership, and offboarding are not handled in separate silos.
- Replace durable access with task-scoped access Introduce short-lived privileges for infrastructure access and reserve standing access for the narrowest set of emergency cases.
What's in the full article
Teleport's full blog post covers the operational detail this post intentionally leaves for the source:
- Specific examples of how Infrastructure Identity maps to kubectl, ssh, and psql access flows.
- The step-by-step approach for defining a cluster and enrolling users, servers, and workloads.
- The access policy pattern for just-in-time access in new AI or Kubernetes projects.
- The operational comparison between unified access and the traditional mix of VPNs, bastion hosts, and secrets managers.
👉 Read Teleport's analysis of Infrastructure Identity and resiliency →
Infrastructure identity and resiliency: are your controls keeping up?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:44 pm
Static credential trust is the wrong premise for modern infrastructure. The article is describing an environment where secrets, passwords, SSH keys, and API tokens are expected to remain stable long enough to be governed. That assumption fails when credentials are replicated across code, pipelines, and runtime systems. The implication is that infrastructure identity is now a lifecycle problem, not just an access control problem.
A few things that frame the scale:
- NHIs outnumber human identities by 25x to 50x in modern enterprises, according to Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how much of the machine identity estate still sits outside reliable governance.
A question worth separating out:
Q: How do organisations know whether infrastructure identity is actually improving resilience?
A: Look for fewer standing credentials, shorter access windows, faster deprovisioning, and a lower volume of manual exceptions during onboarding and audits. If engineers still need to jump between separate systems for routine access, the governance model is not yet unified enough to improve resilience at scale.
👉 Read our full editorial: Infrastructure identity is the missing layer for resilient access
